Incident Response & Breach Notice Summary
Effective Date: [EFFECTIVE DATE] Last Updated: [LAST UPDATED] Version: 2.0
KidStarter maintains documented incident response procedures to identify, contain, investigate, remediate, and report security incidents and personal data breaches. Given that our Service involves children's data, we apply heightened vigilance and urgency.
1. Incident Categories
| Category | Description | Severity |
|---|---|---|
| Critical | Confirmed breach involving children's Personal Data; CSAM detection; active exploitation of a vulnerability | Highest — immediate response |
| High | Confirmed breach involving adult Personal Data; unauthorized access to production systems; ransomware or malware infection | Urgent — response within 1 hour |
| Medium | Suspected breach; failed intrusion attempt with indicators of compromise; data exposure through misconfiguration | Prompt — response within 4 hours |
| Low | Minor policy violation; failed login brute force (blocked); phishing attempt (contained) | Standard — response within 24 hours |
2. Incident Response Process
2.1 Detection and Reporting
- Automated monitoring and alerting systems;
- Employee and contractor reporting through internal channels;
- User reports via [SUPPORT EMAIL] or [REPORT LINK OR EMAIL];
- Third-party notifications (processors, vendors, researchers).
2.2 Triage and Containment
- Incident is triaged for severity and scope;
- Immediate containment actions (e.g., access revocation, system isolation, credential rotation);
- Evidence preservation for investigation and potential law enforcement cooperation.
2.3 Investigation
- Root cause analysis;
- Scope determination (what data was affected, how many individuals, what categories);
- Assessment of risk to individuals (especially minors);
- Forensic analysis where appropriate.
2.4 Remediation
- Fix the vulnerability or close the attack vector;
- Restore affected systems;
- Implement additional safeguards to prevent recurrence;
- Update security controls, policies, and training as needed.
2.5 Post-Incident Review
- Lessons-learned review within 14 days of incident closure;
- Update incident response procedures as needed;
- Report to leadership and, where applicable, the board or advisory council.
3. Breach Notification
3.1 Regulatory Notification
| Jurisdiction | Authority | Timeline | Threshold |
|---|---|---|---|
| EU/EEA (GDPR) | Relevant supervisory authority | 72 hours from awareness | Unless unlikely to result in a risk to individuals' rights and freedoms |
| UK (UK GDPR) | Information Commissioner's Office (ICO) | 72 hours from awareness | Unless unlikely to result in a risk to individuals' rights and freedoms |
| US — Federal | FTC (if COPPA-related) | As required | Breach involving children's Personal Data |
| US — State laws | State Attorney General / affected individuals | Varies (most: 30–60 days; some: as soon as practicable) | Personal information of state residents |
| Canada (PIPEDA) | Office of the Privacy Commissioner | As soon as feasible | Real risk of significant harm |
| Canada (Quebec Law 25) | Commission d'accès à l'information | As soon as feasible | Risk of serious harm |
[Consult legal counsel for your specific state-by-state obligations before publication.]
3.2 Individual Notification
Where required by law, or where the breach is likely to result in a high risk to individuals' rights and freedoms (especially where children's data is involved), we will notify affected individuals:
- Method: Email to the address on file; in-app notification; and, where email is unavailable, prominently posted notice on the Service.
- Content: Description of the nature of the breach; categories and approximate number of individuals affected; likely consequences; measures taken or proposed; contact details for further information.
- Timeline: Without undue delay and in accordance with the applicable legal timeline.
3.3 Processor/Partner Notification
Where the breach involves data processed by KidStarter on behalf of a Controller (e.g., a school under a DPA), we will notify the Controller without undue delay to enable them to meet their own notification obligations.
4. Escalation Matrix
| Severity | Internal Escalation | External Notification |
|---|---|---|
| Critical (children's data, CSAM) | CEO, CTO, Legal, DPO (if appointed), on-call security | Regulators (within legal timelines), law enforcement (NCMEC/IWF if CSAM), affected individuals |
| High | CTO, Legal, DPO (if appointed) | Regulators (within legal timelines), affected individuals if high risk |
| Medium | Security team lead, Legal (if needed) | Regulators only if breach confirmed and threshold met |
| Low | Security team lead | Typically no external notification required |
5. Special Considerations for Children's Data
5.1. Breaches involving children's Personal Data are treated as Critical severity by default, regardless of the volume of data affected.
5.2. Notification to guardians/parents will be prioritized and written in clear, non-technical language.
5.3. Where the breach involves a Campaign for a minor, the affected Campaign may be paused immediately until the incident is resolved.
5.4. KidStarter will cooperate fully with child protection authorities in the investigation of any breach involving children's data.
6. Record Keeping
6.1. KidStarter maintains a breach register documenting all personal data breaches, including: the facts, effects, and remedial actions taken, regardless of whether notification was required.
6.2. The breach register is maintained in accordance with GDPR Article 33(5) and equivalent requirements and is available for inspection by supervisory authorities.
7. User Responsibilities
If you believe your KidStarter account has been compromised, or if you become aware of any security incident involving the Service, contact us immediately:
- Email: [SUPPORT EMAIL]
- Subject Line: "URGENT: Account Compromise" or "URGENT: Security Incident"
- Emergency (child safety): [REPORT LINK OR EMAIL]
8. Contact
Security Incidents: [SECURITY EMAIL] Privacy Inquiries: [PRIVACY EMAIL] General Support: [SUPPORT EMAIL]